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An act to amend Section 22575 of the Business and Professions Code, 
relating to privacy. 

LEGISLATIVE COUNSEL'S DIGEST 

AB 242, as introduced, Chau. Privacy: Internet. 

Existing law requires an operator of a commercial Web site or online 
service that collects personally identifiable information through the 
Internet, about individual consumers residing in California who use or 
visit its commercial Web site or online service, to make its privacy 
policy available to consumers, as specified. 

This bill would require the privacy policy to be no more than 100 
words, be written in clear and concise language, be written at no greater 
than an 8th grade reading level, and to include a statement indicating 
whether the personally identifiable information may be sold or shared 
with others, and if so, how and with whom the information may be 
shared. 

Vote: majority. Appropriation: no. Fiscal committee: no. 
State-mandated local program: no. 

The people of the State of California do enact as follows: 

1 SECTION 1. Section 22575 of the Business and Professions 

2 Code is amended to read: 

3 22575. (a) An operator of a commercial Web site or online 

4 service that collects personally identifiable information through 
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1 the Internet about individual consumers residing in California who 

2 use or visit its commercial Web site or online service shall 

3 conspicuously post its privacy policy on its Web site, or in the case 

4 of an operator of an online service, make that policy available in 

5 accordance with paragraph (5) of subdivision (b) of Section 22577 . 

6 An operator shall be in violation of this subdivision only if the 

7 operator fails to post its policy within 30 days after being notified 

8 of noncompliance. 

9 (b) The privacy policy required by subdivision (a) shall do all 

10 of the following: 

11 (1) Identify the categories of personally identifiable information 

12 that the operator collects through the Web site or online service 

13 about individual consumers who use or visit its commercial Web 

14 site or online service and the categories of third-party persons or 

15 entities with whom the operator may share that personally 

16 identifiable information. 

17 (2) If the operator maintains a process for an individual 

18 consumer who uses or visits its commercial Web site or online 

19 service to review and request changes to any of his or her 

20 personally identifiable information that is collected through the 

21 Web site or online service, provide a description of that process. 

22 (3) Describe the process by which the operator notifies 

23 consumers who use or visit its commercial Web site or online 

24 service of material changes to the operator's privacy policy for 

25 that Web site or online service. 

26 (4) Identify its effective date. 

27 (c) The privacy policy required by this section shall be no more 

28 than 1 00 words and shall be written in clear and concise language 

29 at no greater than an eighth grade reading level. The privacy 

30 policy shall include a statement indicating whether the personally 

3 1 identifiable information may be sold or shared with others, and if 

32 so, how and with whom the information may be shared. 
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